v1.8.2

v1.8.2

Enterprise operations hardening

This release is the result of a blue-team style review of the collector and
installer with production deployment in mind, plus a consistency pass over the
agent. No functional behaviour changes; everything here is about running the
tool safely in a company network.

Hardened (server): file permissions and information disclosure

• Database is no longer world-readable. The collector sets a restrictive
  umask before creating any file and chmods an existing database (plus
  -wal/-shm) to 600. The database records who authenticates to what —
  reconnaissance gold that must not be readable by every local user on a
  shared server. No-op on Windows, where NTFS ACLs govern.
• No Python version in response headers. The Server: header now reads
  NtlmCollector/1.0 without the Python build — one less free hint for
  anyone scanning the network.
• TLS key permission warning. On POSIX systems the collector warns at
  startup when the private key file is world-readable. Group access stays
  silent on purpose: it is common practice (Debian's ssl-cert group), and
  POSIX ACLs — the install script's way of granting the service user read
  access — mirror their mask into the group bits, so warning on those would
  false-alarm on every clean install.

Verified as already solid (no changes needed)

Session tokens expire server-side (a stolen cookie dies after the TTL
regardless of what the client claims), expired sessions are purged, logout
invalidates server-side, and login always issues a fresh token — no session
fixation. There are no state-changing GET endpoints, so the CSRF surface ends
at SameSite=Lax plus CSP form-action 'self'. The installer's secrets file
(collector.env, mode 600) is read by the collector via environment-variable
defaults, so neither the API key nor the dashboard password ever appears in
the process list or the unit file.

Hardened (agent): service password can be prompted

--service-password * now asks for the password interactively with echo
turned off, instead of taking it inline. An inline password lands in the
admin's shell history and — where command-line auditing (event 4688) is
enabled — in the Security log itself; for an NTLM auditing tool that would be
an own goal. gMSA (trailing $, no password) remains the recommended way to
run the service. Empty input aborts cleanly.

Fixed: German placeholder leaked into API data

Rows without a process or target name were filled with (unbekannt) straight
from the SQL layer — on an English dashboard that German word showed up in the
tables. The placeholder is now (unknown); the UI language toggle was never
involved, this was a data value.

Changed: agent log and error messages unified to English

Eight leftover German strings in agent log lines and CLI errors
(unbekanntes Argument, Keine neuen NTLM-Events, …) are now English, in
line with the rest of the code base. Error messages are what people paste
into search engines. The German event label constants (Kontoname,
Gerätename) stay — they are functionality for German-language Windows, not
leftovers.

Upgrade notes

• Collector: replace the file and restart the service. The database
  permission tightening applies automatically on the next start.
• Agent: redeploy is optional — nothing in the collection behaviour
  changed. Redeploy when you want the hidden password prompt at install time
  or the English log lines.
• No database migration, wire protocol unchanged.